Security and vulnerability disclosure
HydroComplete LLC makes AquaSWMM. This policy covers the AquaSWMM desktop app, the aquaswmm-cli command line, the Python package, the web demo and the licence service the app talks to.
Reporting a vulnerability
Email security@aquaswmm.com. Please include:
- the version (Help → About, or
aquaswmm-cli --version) and operating system; - what an attacker can do, and the steps or a file that shows it;
- whether you want to be credited, and under what name.
Please don’t put exploit details in a public issue, forum post or support message.
What happens next
| Step | When |
|---|---|
| We confirm we received the report | within 3 business days |
| We tell you whether we reproduce it, and how severe we think it is | within 10 business days |
| Fix released: critical or high | target 30 days from confirmation |
| Fix released: medium or low | target 90 days, or the next release |
We’ll keep you told of progress, agree a disclosure date with you, and credit you in the release notes unless you’d rather we didn’t. If we need longer than the targets above, we’ll say so and why.
Safe harbor
We won’t pursue legal action against research done in good faith under this policy. That means testing only against your own copy of the software and your own licence, not against other customers’ data or accounts, no denial-of-service against the licence service, and giving us reasonable time to fix before you publish.
In scope
- Code execution, memory exhaustion or a crash from opening a model, GIS, LandXML, DXF, PDF or other file in the app or CLI.
- Anything that lets a licence key be forged, or lets one customer see another’s data on the licence service.
- Supply-chain issues in how releases are built, signed or published.
Out of scope: EPA’s swmm5.dll, which the app can run but does not ship (report it to EPA), and the public data services the app reads from when asked (USGS, NOAA, NRCS, MRLC).
Dependencies
From 0.12.1 on, every release is checked against the RustSec advisory database, and a release does not ship with a known vulnerability that the app can reach. 0.12.0 and earlier include a version of the quick-xml library that a crafted LandXML file can drive into excessive CPU or memory use (RUSTSEC-2026-0194 and -0195). This is fixed in 0.12.1, so until you update, only import LandXML files from sources you trust.